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Amendments to the Claims 
This listing of claims will replace all prior versions of claims in the application: 
Listing of Claims: 

1 . (Currently amended) A machine-implemented system that facilitates spam detection 
comprising a processor executing : 

a feature extraction component that receives an item and extracts a set of features 
associated with an origination of a message or part thereof and/or information that enables an 
intended recipient to contact or respond to the message; 

a feature analysis component that analyzes a subset of the extracted features in 
connection with building and employing a plurality of feature-specific filters that are 
independently trained to mitigate undue influence of at least one feature type over another in the 
message, the subset of extracted features comprising of at least one of a Uniform Resource 
Locator C URL") and an Internet Protocol ( IP) address, and the plurality of feature-specific filters 
comprising at least a first feature-specific filter; and 

a machine learning component that determines whether at least one IP address in the 
message is any one of external or internal to the recipient's system via a machine learning 
technique. 

2. (Original) The system of claim 1 , further comprising a plurality of training components 
that individually employ at least one of IP addresses or URLs and other features, respectively, in 
connection with building the plurality of feature-specific filters. 

3. (Original) The system of claim 1, the first feature-specific filter is trained using IP 
addresses. 

4. (Original) The system of claim 1, the first feature-specific filter is trained using URLs. 
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5. (Original) The system of claim 1, the plurality of feature specific filters comprising a 
second feature-specific filter that is trained using a subset of features extracted from the message 
other than a URL and an IP address. 

6. (Currently amended) A machine-implemented system that facilitates spam detection 
comprising a processor executing : 

a feature extraction component that receives an item and extracts a set of features 
associated with an origination of a message or part thereof and/or information that enables an 
intended recipient to contact or respond to the message; 

at least one filter that is used when one of the an Internet Protocol ( IP) address of the 
message or at least some part of at least one of th e Uniform Resource Locator (U RL) in the 
message is unknown; and 

a machine learning component that determines whether at least one IP address in the 
message is any one of external or internal to the recipient's system via a machine learning 
technique. 

7. (Original) The system of claim 6, the at least one filter is trained using some number of 
bits less than 32 bits of an IP address. 

8. (Previously Presented) The system of claim 1 , further comprising a filter combining 
component that combines information collected from the first feature-specific filter and a second 
feature-specific filter. 

9. (Original) The system of claim 8, the first feature-specific filter detects at least one of 
known IP addresses and at least one known URL in the message. 

10. (Original) The system of claim 8, the second feature- specific filter detects non-IP address 
and non-URL data in the message. 
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1 1 . (Original) The system of claim 8, the filter combining component combines the 
information by at least one of multiplying scores generated by the filters, adding scores 
generated by the filters, or training an additional filter to combine the scores. 

12. (Original) The system of claim 6, the at least one filter is trained using all bits of an IP 
address. 

13. (Previously Presented) The system of claim 6, further comprising a filter selection 
component that selects and employs at least one feature-specific filter out of a plurality of 
feature-specific filters for which there is sufficient data extracted from the message. 

14. (Previously Presented) The system of claim 1 , the first feature-specific filter is trained 
independently of a second feature-specific filter to mitigate either filter influencing the other 
when filtering the message. 

15. (Original) The system of claim 14, at least one of the feature-specific filters models 
dependencies. 

16. (Original) The system of claim 1, the plurality of feature-specific filters is machine 
learning filters. 

17. (Cancelled) 

18. (Previously Presented) The system of claim ¥J- 1 , the machine learning component 
employs MX records to determine a true source of a message by way of tracing back through a 
received from list until an IP address is found that corresponds to a fully qualified domain which 
corresponds to an entry in the domain's MX record; and determines whether the IP address is 
external or internal by performing at least one of the following: 

concluding that the IP address is in a form characteristic to internal IP addresses; and 
performing at least one of an IP address lookup and a reverse IP address lookup to 
ascertain whether the IP address correlates with a sender's domain name. 
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19. (Previously Presented) The system of claim 4-7 1 , the machine learning component 
determines whether the IP address is external or internal comprises at least one of the following: 

collecting user feedback related to user classification of messages as spam or good; 
examining messages classified as good by a user to learn which servers are internal; and 
finding a worst-scoring IP address in a message. 

20. (Currently amended) A machine- implemented system that facilitates spam detection 
comprising a processor executing : 

a feature extraction component that receives an item and extracts a set of features 
associated with an origination of a message or part thereof and/or information that enables an 
intended recipient to contact or respond to the message; 

at least one filter that is used when one of the Internet Protocol ( IP) address of the 
message or at least some part of at least one of the Uniform Resource Locators (T JRLs) in the 
message is known; and 

a machine learning component that determines whether at least one IP address in the 
message is any one of external or internal to the recipient's system via a machine learning 
technique. 

21 . (Original) The system of claim 20, the at least one filter is trained on one of known IP 
addresses or known URLs together with text-based features. 

22. (Original) The system of claim 20, further comprising at least one other filter that is used 
to examine text-based features in the message. 

23. (Currently amended) A machine learning method implemented on a machine that 

facilitates spam detection by optimizing [" [optimizes] ] an objective function of the form 

OBJECTIVE(MAXSCORE(ml), MAXSCORE(m2), . . ., MAXSCORE(mk), wl . . .wn) where 
MAXSCORE(mk) = MAX(SCORE(IPk,l), SCORE(IPk,2), SCORE(IPk,kl)) 

where mk = messages; 
IPk,i represents the presence of some property(s) of mk; 

SCORE(IPk,i) = the sum of the weights of the features of IPk,i, and 
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wherein the machine learning method optimizes the weights associated with one feature 
at any given time and maximizes accuracy on a training data. 

24. (Original) The machine learning method of claim 23, the objective function depends in 
part on whether the messages are properly categorized as any one of spam or good. 

25. (Original) The machine learning method of claim 23, further comprises learning the 
weights for each feature in turn. 

26. (Original) The machine learning method of claim 25, learning the weight for a given 
feature comprises sorting training instances comprising a property, the property comprising a 
feature in order by the weight at which the score for that message varies with the weight for that 
feature. 

27. (Original) The machine learning method of claim 26, the training instances comprise 
electronic messages. 

28. (Original) The machine learning method of claim 23, the messages are training instances 
and the property and the properties comprise one or more IP addresses that the message 
originated from and any URLs in the message. 

29. (Original) The machine learning method of claim 23, learning is performed using an 
approximation MAX(ai, a 2 , . . ., a n ) is approximately equal to SUM(ai x , a 2 x , . . ., a n x ) (1/x) . 

30. (Original) The machine learning method of claim 29, the objective function depends in 
part on whether the messages are properly categorized as spam or good. 
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3 1 . (Currently amended) A machine- implemented method that facilitates spam detection 
comprising: 

providing a plurality of training data; 

extracting a plurality of feature types from the training data, the feature types comprising 
at least one Internet Protocol ( IP) address, at least one Uniform Resource Locator ( URL) and 
text-based features; and 

training a plurality of feature-specific filters for the respective feature in an independent 
manner so that a first feature does not unduly influence a message score over a second feature 
type when determining whether a message is spam; and 

determining whether at least one IP address in the training data is any one of external or 
internal to a recipient's system. 

32. (Original) The method of claim 0, the plurality of training data comprises messages. 

33. (Original) The method of claim 0, the plurality of feature-specific filters comprises at 
least two of the following: 

a known IP address filter; 
an unknown IP address filter; 
a known URL filter; 
an unknown URL filter; and 
a text-based filter. 

34. (Original) The method of claim 33, the known IP address filter is trained using 32 bits of 
IP addresses. 

35. (Original) The method of claim 33, the unknown IP address filter is trained using some 
number of bits of IP addresses less than 32 bits. 

36. (Original) The method of claim 33, the unknown IP address filter is trained using other 
messages comprising unknown IP addresses. 
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37. (Original) The method of claim 33, the text-based filter is trained using words, phrases, 
character runs, character strings, and any other relevant non-IP address or non-URL data in the 
message. 

38. (Original) The method of claim 33, employing at least one of the known IP address filter, 
the unknown IP address filter, the known URL filter, and the unknown URL filter together with 
the text-based filter to more accurately determine whether a new message is spam. 

39. (Original) The method of claim 33, further comprising employing at least one of the 
feature-specific filters in connection with determining whether a new message is spam, such that 
the feature-specific filter is selected based in part on most relevant feature data observed in the 
new message. 

40. (Original) The method of claim 33, the URL filter is trained on URL data comprising a 
fully qualified domain name and subdomains of the fully qualified domain name. 

41 . (Original) The method of claim 0, further comprising combining message scores 
generated from at least two filters used to scan a new message to generate a total score that 
facilitates determining whether the message is spam. 

42. (Original) The method of claim 41, combining message scores comprises at least one of 
the following: 

multiplying the scores; 
adding the scores; and 
training a new model to combine the scores. 

43. (Original) The method of claim 33 combined with a feedback loop mechanism whereby 
users provide their feedback regarding incoming messages by submitting message classifications 
to fine tune the one or more feature-specific filters. 
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44. (Original) The method of claim 0, further comprising quarantining messages that satisfy 
at least one criterion for a period of time until additional information about the message can be 
collected to update one or more feature-specific filters to facilitate determining whether the 
messages are spam. 

45. (Currently amended) A data packet adapted to be transmitted between two or more 
computer processes running on a machine-implemented system facilitating improved detection 
of spam, the data packet comprising: information associated with training a plurality of feature- 
specific filters in an independent manner to mitigate undue influence between features and 
employing at least one feature specific filter comprising an Internet Protocol ( IP) address filter or 
a Uniform Resource Locator ( URL) filter to determine whether a message is spam and to 
determine whether at least one IP address in the message is any one of external or internal to a 
recipient's system. 

46. (Previously Presented) A computer readable medium having stored thereon the 
components of claim 1 . 

47. (Original) A spam detection system comprising a plurality of filters comprising at least 
one filter that is trained by using different smoothing for different spam features. 

48. (Original) The system of claim 47, the feature is one of the following: an IP address or a 
portion thereof or a URL or a portion thereof. 

49. (Original) The system of claim 48, the at least one filter is trained by using different 
smoothing for different portions of at least one of an IP address or a URL. 
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50. (Currently amended) A machine- implemented method that facilitates spam detection 
comprising: 

extracting data from a plurality of messages; 

training at least one machine learning filter using at least a subset of the 
data, the training comprising employing a first smoothing for at least one of Internet Protocol 
(IP) address or Uniform Resource Locator ( URL) features and at least a second smoothing for 
other non-IP address or non-URL features; and 

determining whether at least one IP address in the message is any one of external or 
internal to the recipient's system. 

5 1 . (Previously Presented) The method of claim 0, the smoothing differs in at least one of the 
following aspects: 

the first smoothing comprises a different variance compared to the second smoothing 
with respect to a maximum entropy model; and 

the first smoothing comprises a different value of weight decay compared to the second 
smoothing with respect to a an SVM model. 
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